CVE-2026-104020 vulnerability in Amazon Products
Published on October 1, 2026
Uncontrolled recursion in the Ion reader in Amazon Ion Python
Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value.
To remediate this issue, users should upgrade to version 0.15.0 or later.
Vulnerability Analysis
CVE-2026-104020 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is a Stack Exhaustion Vulnerability?
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.
CVE-2026-104020 has been classified to as a Stack Exhaustion vulnerability or weakness.
Products Associated with CVE-2026-104020
stack.watch emails you whenever new vulnerabilities are published in Amazon Aws or Amazon Ion Python. Just hit a watch button to start following.